oxidecomputer / console

Oxide Web Console
https://console-preview.oxide.computer
Mozilla Public License 2.0
133 stars 10 forks source link

Instance: Make firewall rules more visible #2064

Open askfongjojo opened 6 months ago

askfongjojo commented 6 months ago

Users new to us are not necessarily aware of the need to add/modify firewall rules in order to access their applications outside of the rack. The "VPC" name on the instance page (or Create Instance page) also does not suggest anything related to security for that matter. Here are two suggestions for users to have a better chance of getting the firewall rules right:

  1. Create Instance: provide a link on/near the VPC name that lands on the Firewall Rules tab of the VPC selected by the user (perhaps open a new tab so that the user can stay on Create Instance); this allows them to confirm if the VPC selected is right for them.
  2. Instance details: provide a similar link to the VPC Firewall Rules or add another subtab (named more generally as "Security", similar to other public cloud portals) that actually displays all the rules in that VPC.
david-crespo commented 6 months ago

Ben did some related experimentation in #1890

askfongjojo commented 6 months ago

Thanks for pointing me to the PR! (I only searched for related issues but totally forgot about open PRs before I filed this.) It covers exactly the second item in this ticket and great discussions about it. I second the idea of not making edit rules available on the instance tab (to prevent user from inadvertently changing the rules on other instances) and not trying to determine which rules apply to the instance (for the various reasons stated in the PR comments). cc @benjaminleonard

charliepark commented 4 months ago

One possibility: VPC link on instance detail table says "VPC / Firewall Rules"

charliepark commented 4 months ago

Here's what that looks like …

Screenshot 2024-05-09 at 1 13 28 PM
charliepark commented 4 months ago

Crespo and I are both "decidedly 'meh'" on that approach

charliepark commented 3 months ago

This does not need to be in Release 9, and we don't have a compelling solution to the problem, so I removed the 9 Milestone tag.